What is CVE-2026-124033?

CVE-2026-124033 is a medium-severity vulnerability in AWS Aws-Parallelcluster, classified under Relative Path Traversal. CVSS score: 6.4/10. Published 2026-11-09.

How severe is CVE-2026-124033?

Medium severity. CVSS v3 base score is 6.4 out of 10.

Path Traversal in AWS Aws-Parallelcluster

CVE-2026-124033

The export-cluster-logs and export-image-logs commands in the AWS ParallelCluster CLI before version 3.16.0 contain a relative path traversal issue. An authenticated remote user with write access to the log export Amazon S3 bucket could use a crafted S3 object key to write files outside the intended export directory on the machine running the command. The written files would have names and content controlled by a third party, and would be created with the privileges of the user running the command. To remediate this issue, users should upgrade to version 3.16.0 or later.

Published 2026-11-09 · last modified 2026-11-09.

CVSS v3 metric

CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

AWS Aws-Parallelcluster

Weakness classification (CWE)

CWE-23 — Relative Path Traversal

References

github.com/aws/aws-parallelcluster/releases/tag/v3.16.0 (release-notes, patch)
aws.amazon.com/security/security-bulletins/2026-174-aws/ (vendor-advisory)
github.com/aws/aws-parallelcluster/security/advisories/GHSA-h79v-mp93-644r (third-party-advisory)

Frequently asked questions

What is CVE-2026-124033?: CVE-2026-124033 is a medium-severity vulnerability in AWS Aws-Parallelcluster, classified under Relative Path Traversal. CVSS score: 6.4/10. Published 2026-11-09.
How severe is CVE-2026-124033?: Medium severity. CVSS v3 base score is 6.4 out of 10.